> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of RB > Sent: Friday, June 18, 2010 5:08 AM > To: rsyslog-users > Subject: Re: [rsyslog] feedback requested: NEW rsyslog.conf format > > On Thu, Jun 17, 2010 at 18:09, Aaron Wiebe <[email protected]> wrote: > > I think most of the concerns that seem to be going around (of which a > > lot of them seem to be terminology) would be resolved if we have the > > ability to chain rulesets into each other - which I believe omruleset > > presently is capable of - a ruleset being an output target. Is that > > correct? > > I believe you are correct.
Yes, this is correct, even though omruleset is a bit of hackish, it works quite well. With the new config system, there is a much cleaner and easier to grasp implementation possible. > I'd consider it a rather complex > configuration, but then again - the user would be requesting rather > complex behavior from rsyslog. One thing that you (RB) brought up is very interesting: the ability to parse a message multiple times. Would that actually be useful? So far, I have worked on the assumption that a message will be parsed exactly once, thinking that the parser is bound to a device-specific format (and all messages from the same device have the same format). Note that even today it is possible to MODIFY messages after they are parsed. Message modification modules do that. However, there currently does not exist any such module. I had no need to create one and as it looks nobody else had ;) Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
